Skip to content

CI: Harden GHA configuration #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
tacaswell wants to merge 2 commits into
base: main
Choose a base branch
from
Open

CI: Harden GHA configuration #14

tacaswell wants to merge 2 commits into from

Conversation

@tacaswell
Copy link

@tacaswell tacaswell commented Jul 8, 2025 •
edited
Loading

Apply recommended hardening steps including:

  • pinning to a SHA any actions used
  • not persisting the read token on checkout
  • setting the default permissions to read-only

tacaswell added 2 commits July 8, 2025 17:50
@tacaswell
CI: harden GHA configuration
aef30c6 
This adjusts the defaults per suggestions of zizmor to
reduce possible risks from giving GHA tasks more permissions
that required.
@tacaswell
CI: pin actions by SHA
0cfe0a2 
This eliminates the possibility of a tag being changed under
us.
@tacaswell tacaswell changed the title CI: harden GHA configuration CI: Harden GHA configuration Jul 9, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@tacaswell